Privacy Policy

1. Introduction

Parsivex ("Parsivex," "we," "us," or "our") is operated by Parsivex ApS, a company registered in Denmark at Erantisvej 5, 2970 Hørsholm, Denmark ("Company"). This Privacy Policy explains what information we collect when you use our website and application (together, the "Service"), how we use it, who we share it with, and the choices you have.

By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

2. Information We Collect

Account information

When you sign up, we collect your name, email address, and authentication details via our identity provider, Auth0. We do not store your password ourselves.

AWS connection information

To run a scan, you grant Parsivex a read-only IAM role in your AWS account. We store only the Role ARN and External ID for that connection — never long-term AWS credentials. When we access your account, we call AWS AssumeRole to obtain temporary credentials that expire within one hour. See our Security & Trust page for the exact IAM policy we request.

Scan and report data

We store aggregated cost and resource data collected during a scan — findings, estimated savings, and resource metadata such as "this EC2 instance is idle" — to generate your report. We do not store the contents of your S3 buckets, application secrets, or environment variables; the IAM policy we request does not grant access to them.

Billing information

If you subscribe to a paid plan, payment is processed by Stripe. We do not store your card number or other payment credentials — Stripe handles that data directly under its own privacy policy.

Communications and support data

If you email us, use in-app chat (paid plans), or contact support, we retain that correspondence to respond to you and improve the Service.

Usage and analytics data

We use analytics to understand how the Service is used and how visitors reach us: Vercel Analytics and PostHog for aggregate and event-level product-usage statistics, and Google Analytics 4 together with Google Ads to measure the effectiveness of our advertising (for example, which ads lead to a free scan or a subscription). To improve the accuracy of that advertising measurement, we may share a hashed (irreversible) version of your email address with Google — a feature Google calls "Enhanced Conversions." We do not share your AWS resource data, findings, or reports with Google or any advertising platform. See Section 8 for details and your choices.

Cookies

We use essential cookies required for authentication and session management. Where required, and subject to your consent, we also use analytics and advertising cookies and similar technologies (for example, from Google) to measure how the Service is used and how effective our advertising is. You can decline or withdraw consent for these non-essential cookies at any time — see Section 8.

3. How We Use Information

We use the information above to:

• Provide, operate, and maintain the Service, including running scans and generating reports
• Process payments and manage subscriptions
• Send transactional emails, such as scan started, scan complete, and billing receipts, and, if you opt in, product updates
• Measure the effectiveness of our marketing and advertising, including which ads and channels lead to signups and subscriptions
• Detect and prevent abuse, fraud, and violations of our Terms of Service, for example through rate limiting and blocking disposable email addresses at signup
• Diagnose and fix errors, using Sentry error tracking, which may capture technical details such as stack traces
• Comply with legal obligations

4. Legal Basis for Processing (EEA/UK Users)

If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases: performance of a contract (providing the Service you signed up for), legitimate interests (securing the Service, preventing abuse, improving the product), and consent (where required, for example certain marketing communications).

5. Who We Share Data With

We share data with the following categories of service providers ("subprocessors"), each bound by their own data protection obligations:

We do not sell your personal information, and we do not share your AWS resource data with advertising or data-broker platforms.

We may also disclose information if required by law, to protect the rights and safety of Parsivex or others, or in connection with a merger, acquisition, or sale of assets, in which case we will notify you.

6. International Data Transfers

Our subprocessors may process data outside your country of residence, including in the United States. Where required, we rely on appropriate safeguards, such as Standard Contractual Clauses, for these transfers.

7. Data Retention

Deleting your Parsivex account does not delete the IAM role in your AWS account — you must remove that separately from the AWS IAM console. See Revoking Parsivex access.

8. Analytics and Future Instrumentation

We use Vercel Analytics and PostHog for aggregate and event-level product-usage analytics, for example to understand which parts of the free scan flow lead to an upgrade. We use Google Analytics 4 together with Google Ads for advertising conversion measurement — to see which ads and channels lead to signups and subscriptions. This includes Google's Enhanced Conversions, where a hashed, irreversible version of your email address is sent to Google to match ad clicks to those conversions; Google is contractually restricted in how it may use this data.

For visitors in the EEA/UK, non-essential analytics and advertising tags (including PostHog and Google Analytics/Ads) load only after you consent, and you can withdraw consent at any time; we communicate these choices to Google through consent signals (Google Consent Mode). Vercel Web Analytics is cookieless audience measurement that does not store identifiers on your device and is not gated behind the banner for that reason. You can also opt out of Google Analytics using Google's browser opt-out add-on. If we materially change how we use analytics or advertising instrumentation, we will update this policy and, where required, provide notice or obtain consent beforehand.

9. Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Receive a copy of your data in a portable format
• Withdraw consent at any time, where processing is based on consent

You can delete your own account and data at any time from Settings → Danger zone → Delete account, or by emailing hello@parsivex.com.

10. Data Security

We use industry-standard safeguards, including encryption in transit (TLS) and at rest, a read-only-by-design AWS integration, and an External ID to prevent confused-deputy attacks. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Children's Privacy

The Service is not directed to individuals under 16, and we do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service. The "Last updated" date on this page reflects the most recent revision.

13. Contact Us

Questions about this Privacy Policy or your data can be sent to hello@parsivex.com, or by mail to Parsivex ApS, Erantisvej 5, 2970 Hørsholm, Denmark.